\subsection{The measure problem}
Let \( \mathbb I \) denote the unit interval \( [0,1] \subseteq \mathbb R \).
A function \( \mu : \mathcal P(\mathbb I) \to \mathbb I \) is called a \emph{measure} if
\begin{enumerate}
    \item \( \mu(\mathbb I) = 1 \) and \( \mu(\varnothing) = 0 \);
    \item (translation invariance) if \( X \subseteq \mathbb I \), \( r \in \mathbb R \), and \( X + r = \qty{x + r \mid x \in X} \subseteq \mathbb I \), then \( \mu(X) = \mu(X + r) \); and
    \item (countable additivity) if \( (A_n)_{n \in \mathbb N} \) is a family of pairwise disjoint subsets of \( \mathbb I \), then \( \mu\qty(\bigcup_{n \in \mathbb N} A_n) = \sum_{n \in \mathbb N}\mu(A_n) \).
\end{enumerate}
The \emph{Lebesgue measure problem} was the question of whether such a measure function exists.
Vitali proved that a measure cannot be defined on all of \( \mathcal P(\mathbb I) \).
This proof requires the axiom of choice nontrivially.
In 1970, Solovay proved that if \( \mathsf{ZFC} + \mathsf{IC} \) is consistent, then, there is a model of \( \mathsf{ZF} \) in which all sets are Lebesgue measurable.
In 1984, Shelah showed that the inaccessible cardinal was necessary to construct this model.

Now, replace translation invariance with the requirement that for all \( x \in \mathbb I \), we have \( \mu(\qty{x}) = 0 \), and call such measures \emph{Banach measures}.
\emph{Banach's measure problem} was the question of whether a Banach measure exists.
Note that every Lebesgue measure is a Banach measure.
If \( \mu(\qty{x}) > 0 \) for some \( x \), then by translation invariance, every singleton has the same measure \( \mu(\qty{x}) > 0 \).
There is some natural number \( n \) such that \( n \mu(\qty{x}) > 1 \), but this contradicts countable additivity using a set of \( n \) reals.
Observe that for any \( \varepsilon > 0 \), there can be only finitely many pairwise disjoint sets with measure at least \( \varepsilon \).

Banach and Kuratowski proved in 1929 that the continuum hypothesis implies that there are no Banach measures on \( \mathbb I \).
We can define Banach measures on any set \( S \) by also replacing property (i) with the requirement that \( \mu(S) = 1 \) and \( \mu(\varnothing) = 0 \).
Note that if \( \abs{S} = \abs{S'} \), then there is a Banach measure on \( S \) if and only if there is one on \( S' \).
Thus, having a Banach measure is a property of cardinals.

For larger cardinals, it may not be natural to just consider countable additivity.
\begin{definition}
    A Banach measure \( \mu \) is called \emph{\( \lambda \)-additive} if for all \( \gamma < \lambda \) and pairwise disjoint families \( \qty{A_\alpha \mid \alpha < \gamma} \), then
    \[ \mu\qty(\bigcup A_\alpha) = \sup\qty{\sum_{\alpha \in F} \mu(A_\alpha) \midd F \subseteq \gamma \text{ finite}} \]
\end{definition}
\begin{theorem}
    If \( \kappa \) is the smallest cardinal that has a Banach measure, then that measure is \( \kappa \)-additive.
\end{theorem}

\subsection{Real-valued measurable cardinals}
\begin{definition}
    A cardinal \( \kappa \) is \emph{real-valued measurable}, written \( \mathsf{RVM}(\kappa) \), if there is a \( \kappa \)-additive Banach measure on \( \kappa \).
\end{definition}
\begin{proposition}
    Every real-valued measurable cardinal is regular.
\end{proposition}
\begin{proof}
    Suppose that \( \kappa \) is a real-valued measurable cardinal, and that \( C \subseteq \kappa \) is cofinal with \( \abs{C} = \lambda < \kappa \).
    We can write
    \[ C = \qty{\gamma_\alpha \mid \alpha < \gamma} \]
    where \( \gamma_\alpha \) is increasing in \( \alpha \).
    Consider
    \[ C_\alpha = \qty{\xi \mid \gamma_\alpha \leq \xi < \gamma_{\alpha + 1}} \]
    Then \( \bigcup_{\alpha < \gamma} C_\alpha = \kappa \) as \( C \) is cofinal, and the \( C_\alpha \) are disjoint.
    Note that \( \abs{C_\alpha} \leq \abs{\gamma_{\alpha + 1}} < \kappa \).
    Writing \( C_\alpha = \bigcup_{x \in C_\alpha} \qty{x} \), we observe by \( \kappa \)-additivity that \( \mu(C_\alpha) = 0 \).
    But again by \( \kappa \)-additivity, \( \mu(\kappa) = 0 \), contradicting property (i).
\end{proof}
\begin{proposition}[the pigeonhole principle]
    Let \( \kappa \) be regular, \( \lambda < \kappa \), and \( f : \kappa \to \lambda \).
    Then there is some \( \alpha \in \lambda \) such that \( \abs{f^{-1}(\alpha)} = \kappa \).
\end{proposition}
\begin{proof}
    We have
    \[ \kappa = \bigcup_{\alpha \in \lambda} f^{-1}(\alpha) \]
    giving the result immediately by regularity of \( \kappa \).
\end{proof}
\begin{proposition}
    All successor cardinals are regular.
\end{proposition}
\begin{proposition}
    If \( \mu \) is a Banach measure on \( S \), and \( C \) is a family of pairwise disjoint sets of positive \( \mu \)-measure, then \( C \) is countable.
\end{proposition}
\begin{proof}
    Consider the collection
    \[ C_n = \qty{A \in C \mid \mu(A) > \frac{1}{n}} \]
    Observe that each \( C_n \) is finite, so \( C = \bigcup_{n \in \mathbb N} C_n \) must be countable.
\end{proof}
\begin{lemma}[Ulam]
    For any cardinal \( \lambda \), there is an \emph{Ulam matrix} \( A_\alpha^\xi \) indexed by \( \alpha < \lambda^+ \) and \( \xi < \lambda \) such that
    \begin{enumerate}
        \item for a given \( \xi \), the set \( \qty{A_\alpha^\xi \mid \alpha < \lambda^+} \) is a pairwise disjoint family; and
        \item for a given \( \alpha \), then
        \[ \abs{\lambda^+ \setminus \bigcup_{\xi < \lambda} A_\alpha^\xi} \leq \lambda \]
    \end{enumerate}
\end{lemma}
\begin{proof}
    For each \( \gamma < \lambda^+ \), fix a surjection \( f_\gamma : \lambda \to \gamma + 1 \).
    Define
    \[ A_\alpha^\xi = \qty{\gamma \mid f_\gamma(\xi) = \alpha} \]
    It is clear that property (i) holds.
    For property (ii), suppose
    \[ \gamma \in \lambda^+ \setminus \bigcup_{\xi < \lambda} A_\alpha^\xi \]
    Then \( \gamma < \lambda^+ \) and for all \( \xi \), we have \( f_\gamma(\xi) \neq \alpha \).
    Hence
    \[ \lambda^+ \setminus \bigcup_{\xi < \lambda} A_\alpha^\xi \subseteq \alpha \]
    so the size of this set is at most \( \lambda \).
\end{proof}
\begin{theorem}
    Every real-valued measurable cardinal is weakly inaccessible.
\end{theorem}
\begin{remark}
    If there is a Banach measure on \( [0,1] \), then in particular \( 2^{\aleph_0} \) is weakly inaccessible.
\end{remark}
\begin{proof}
    We have already shown regularity.
    Suppose \( \kappa \) is not a limit cardinal, so \( \kappa = \lambda^+ \).
    Let \( (A_\alpha^\xi)_{\alpha < \lambda^+; \xi < \lambda} \) be an Ulam matrix for \( \lambda \).
    By (ii),
    \[ \abs{Z_\alpha} \leq \lambda;\quad Z_\alpha = \lambda^+ \setminus \bigcup_{\xi < \lambda} A_\alpha^\xi \]
    so by \( \kappa \)-additivity, \( \mu(Z) = 0 \).
    Hence
    \[ \mu\qty(\bigcup_{\xi < \lambda} A_\alpha^\xi) = 1 \]
    This is a small union of sets of measure 1, so again by \( \kappa \)-additivity there is some \( \xi_\alpha \) such that \( \mu(A_\alpha^{\xi_\alpha}) > 0 \).
    Let \( f : \lambda^+ \to \lambda \) be the map \( \alpha \mapsto \xi_\alpha \).
    By the pigeonhole principle, there is some \( \xi \) and a set \( A \subseteq \lambda^+ \) with \( \abs{A} = \lambda^+ \) such that for all \( \alpha \in A \), we have \( \xi_\alpha = \xi \).
    By property (i), the collection \( \qty{A_\alpha^\xi \mid \alpha \in A} \) is a collection of uncountable size \( \lambda^+ \) of pairwise disjoint sets, all of which have positive measure, but we have already shown that such a collection must be countable.
\end{proof}

\subsection{Measurable cardinals}
\begin{definition}
    A Banach measure \( \mu \) is called \emph{two-valued} if \( \mu \) takes values in \( \qty{0,1} \).
\end{definition}
This removes any mention of the real numbers from the definition of a Banach measure.
\begin{remark}
    Two-valued measures correspond directly to ultrafilters.
    Recall that \( F \) is a \emph{filter} on \( S \) if
    \begin{enumerate}
        \item \( \varnothing \notin F, S \in F \);
        \item if \( A \subseteq B \) then \( A \in F \to B \in F \);
        \item if \( A, B \in F \) then \( A \cap B \in F \).
    \end{enumerate}
    We say that \( F \) is an \emph{ultrafilter} if \( A \in F \) or \( S \setminus A \in F \) for all \( A \subseteq S \).
    \( F \) is \emph{nonprincipal} if for all \( x \in S \), the singleton \( \qty{x} \) is not in \( F \).
    An ultrafilter is \( \lambda \)-complete if for all \( \gamma < \lambda \) and all families \( \qty{A_\alpha \mid \alpha < \gamma} \subseteq F \), we have \( \bigcap_{\alpha < \gamma} A_\alpha \in F \).
    In this way, the collection of sets of a two-valued Banach measure \( \mu \) that are assigned measure \( 1 \) form a nonprincipal ultrafilter.
    This filter is \( \lambda \)-complete if and only if \( \mu \) is \( \lambda \)-additive.
\end{remark}
\begin{definition}
    An uncountable cardinal \( \kappa \) is \emph{measurable}, written \( \mathsf{M}(\kappa) \), if there is a \( \kappa \)-complete nonprincipal ultrafilter on \( \kappa \).
\end{definition}
\begin{remark}
    \begin{enumerate}
        \item \( \mathsf{ZFC} \) proves that there is an \( \aleph_0 \)-complete nonprincipal ultrafilter on \( \aleph_0 \), because \( \aleph_0 \)-completeness is equivalent to closure under finite intersections, which is trivial.
        \item A cardinal \( \kappa \) is called \emph{Ulam measurable} if there is an \( \aleph_1 \)-complete nonprincipal ultrafilter on \( \kappa \).
        With this definition, the least Ulam measurable cardinal is measurable.
        So the existence of an Ulam measurable cardinal is equivalent to the existence of a measurable cardinal.
        \item The theories \( \mathsf{ZFC} + \mathsf{MC} \) and \( \mathsf{ZFC} + \mathsf{RVMC} \) are equiconsistent.
        This can be shown analogously to inaccessible and weakly inaccessible cardinals, this time using a variant of G\"odel's constructible universe.
    \end{enumerate}
\end{remark}
\begin{theorem}
    Every measurable cardinal is inaccessible.
\end{theorem}
\begin{proof}
    We have already shown regularity in the real-valued measurable cardinal case.
    Let \( \kappa \) be measurable with ultrafilter \( U \).
    Suppose it is not a strong limit, so there is \( \lambda < \kappa \) such that \( 2^\lambda \geq \kappa \).
    Then there is an injection \( f : \kappa \to B_\lambda \), where \( B_\lambda \) is the set of functions \( \lambda \to 2 \).
    Fix some \( \alpha < \lambda \), then for each \( \gamma < \kappa \), either
    \[ f(\gamma)(\alpha) = 0 \text{ or } f(\gamma)(\alpha) = 1 \]
    Let
    \[ A_0^\alpha = \qty{\gamma \mid f(\gamma)(\alpha) = 0};\quad A_1^\alpha = \qty{\gamma \mid f(\gamma)(\alpha) = 1} \]
    These two sets are disjoint and have union \( \kappa \).
    So there is exactly one number \( b \in \qty{0,1} \) such that \( A^\alpha_b \in U \).
    Define \( c \in B_\lambda \) by \( c(\alpha) = b \).
    Then
    \[ X_\alpha = A^\alpha_{c(\alpha)} \in U \]
    This is a collection of \( \lambda \)-many sets that are all in \( U \), so by \( \kappa \)-completeness, their intersection \( \bigcap_{\alpha < \lambda} X_\alpha \) also lies in \( U \).
    Suppose \( \gamma \in \bigcap_{\alpha < \lambda} X_\alpha \), so for all \( \alpha < \lambda \), we have \( \gamma \in A^\alpha_{c(\alpha)} \).
    Equivalently, for all \( \alpha < \lambda \), we have \( f(\gamma)(\alpha) = c(\alpha) \).
    So \( \gamma \) lies in this intersection if and only if \( f(\gamma) \) is precisely the function \( c \).
    Hence
    \[ \bigcap_{\alpha < \lambda} X_\alpha \subseteq \qty{f^{-1}(c)} \]
    So this intersection has either zero or one element, and in particular, it is not in the ultrafilter, giving a contradiction.
\end{proof}
Nonprincipal ultrafilters on \( \kappa \) are not \( \kappa^+ \)-complete, because \( \kappa \) itself is a union of \( \kappa \)-many singletons.
Principal ultrafilters are complete for any cardinal.
However, we can emulate completeness for nonprincipal ultrafilters at larger cardinals using the following method.
If \( (A_\alpha)_{\alpha \leq \kappa} \) is a sequence of subsets of \( \kappa \), its \emph{diagonal intersection} is
\[ \operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha \leq \kappa} A_\alpha = \qty{\xi \in \kappa \midd \xi \in \bigcap_{\alpha < \xi} A_\alpha} \]
A filter on \( \kappa \) is called \emph{normal} if it is closed under diagonal intersections.
\begin{theorem}
    If \( \kappa \) is measurable, then there is a \( \kappa \)-complete normal nonprincipal ultrafilter on \( \kappa \).
\end{theorem}
The proof will be given later, and is also on an example sheet.

\subsection{Weakly compact cardinals}
Let \( [X]^n \) be the set of \( n \)-element subsets of \( X \).
A \emph{2-colouring} of \( \mathbb N \) is a map \( c : [\mathbb N]^2 \to \qty{\text{red}, \text{blue}} \).
Ramsey's theorem states that for each 2-colouring \( c \), there is an infinite subset \( X \subseteq \mathbb N \) such that \( \eval{c}_{[X]^2} \) is \emph{monochromatic} (or \emph{homogeneous}): each 2-element subset is given the same colour under \( c \).

This property is invariant under bijection, so this is really a property of the cardinal \( \aleph_0 \).
In \emph{Erd\H{o}s' arrow notation}, we write
\[ \kappa \to (\lambda)_m^n \]
if for every colouring \( c : [\kappa]^n \to m \), there is a monochromatic subset \( X \subseteq \kappa \) of size \( \lambda \):
\[ \abs{c[[X]^n]} = 1 \]
In this notation, Ramsey's theorem becomes the statement
\[ \aleph_0 \to (\aleph_0)_2^2 \]
We can now make the following definition.
\begin{definition}
    An uncountable cardinal \( \kappa \) is called \emph{weakly compact}, written \( \mathsf{W}(\kappa) \), if \( \kappa \to (\kappa)_2^2 \).
\end{definition}
The name will be explained later.
\begin{theorem}[Erd\H{o}s]
    Every weakly compact cardinal is inaccessible.
\end{theorem}
\begin{proof}
    Suppose \( \kappa \) is weakly compact but not regular.
    Then \( \kappa = \bigcup_{\alpha < \lambda} X_\alpha \) for \( \alpha < \kappa \) and disjoint sets \( X_\alpha \) with \( \abs{X_\alpha} < \kappa \).
    We define a colouring \( c \) as follows.
    A pair \( \qty{\gamma,\delta} \) is red if \( \gamma, \delta \) lie in the same \( X_\alpha \), and blue if they are in different \( X_\alpha \).
    Let \( H \subseteq \kappa \) be a monochromatic subset of size \( \kappa \) for \( c \).
    If \( H \) is red, then one of the \( X_\alpha \) is large, which is a contradiction.
    But if \( H \) is blue, then \( \lambda \) must be large, which also gives a contradiction.

    Suppose that \( \kappa \) is not a strong limit, so \( 2^\lambda \geq \kappa \) for \( \lambda < \kappa \).
    Let \( B_\lambda \) be the set of functions \( \lambda \to 2 \), and give it the \emph{lexicographic order}: we say that \( f < g \) if \( f(\alpha) < g(\alpha) \) at the first position \( \alpha \) at which \( f \) and \( g \) disagree.
    For this proof, we will use the combinatorial fact that this ordered structure \( (B_\lambda, \leq_{\mathrm{lex}}) \) is a totally ordered set with no increasing or decreasing chains of length \( \kappa > \lambda \).
    The proof is on an example sheet.

    If \( 2^\lambda \geq \kappa \), there is a family of pairwise distinct elements \( (f_\alpha)_{\alpha < \kappa} \) of \( B_\lambda \) of length \( \kappa \).
    Define a colouring \( c \) of \( \kappa \) as follows.
    A pair \( \alpha, \beta \) is red if the truth value of \( \alpha < \beta \) is the same as the truth value of \( f_\alpha \leq_{\mathrm{lex}} f_\beta \).
    A pair is blue otherwise.
    Let \( H \) be a monochromatic set for \( c \).
    If \( H \) is red, then \( f_\alpha \) forms a \( \leq_{\mathrm{lex}} \)-increasing sequence of length \( \kappa \).
    If \( H \) is blue, then \( f_\alpha \) forms a \( \leq_{\mathrm{lex}} \)-decreasing sequence of length \( \kappa \).
    Both results contradict the combinatorial result above.
\end{proof}
\begin{theorem}
    Every measurable cardinal is weakly compact.
\end{theorem}
\begin{proof}
    Let \( f : [\kappa]^2 \to 2 \) be a colouring of a measurable cardinal \( \kappa \).
    Let
    \[ X_0^\alpha = \qty{\beta \mid f(\qty{\alpha, \beta}) = 0};\quad X_1^\alpha = \qty{\beta \mid f(\qty{\alpha, \beta}) = 1} \]
    For a given \( \alpha \), these are disjoint, and \( X_0^\alpha \cup X_1^\alpha = \kappa \setminus \qty{\alpha} \), so precisely one of them lies in the ultrafilter \( U \).
    Define \( c : \kappa \to 2 \) be such that \( X_{c(\alpha)}^\alpha \in U \).
    Now, let
    \[ X_0 = \qty{\alpha \mid c(\alpha) = 0};\quad X_1 = \qty{\alpha \mid c(\alpha) = 1} \]
    Precisely one of these two sets lies in \( U \).

    We claim that if \( X_i \in U \), then there is a monochromatic set \( H \) for colour \( i \) with \( \abs{H} = \kappa \).
    Without loss of generality, we may assume \( i = 0 \).
    Define
    \[ Z_\alpha = \begin{cases}
        X^\alpha_0 \mid c(\alpha) = 0 & \text{if } c(\alpha) = 0 \\
        \kappa & \text{if } c(\alpha) = 1
    \end{cases} \]
    Each of the \( Z_\alpha \) lie in the ultrafilter \( U \).
    As we may assume \( U \) is normal, the diagonal intersection of the \( Z_\alpha \) also lies in \( U \).
    So we can define
    \[ H = X_0 \cap \operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha \leq \kappa} Z_\alpha \in U \]
    and \( \abs{H} = \kappa \).
    Let \( \gamma < \delta \) with \( \gamma, \delta \in H \).
    Then \( \gamma, \delta \in X_0 \), so \( c(\gamma) = 0 = c(\delta) \).
    Hence \( Z_\gamma = X^\gamma_0 \) and \( Z_\delta = X^\delta_0 \).
    In particular,
    \[ \delta \in \operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha \leq \kappa} Z_\alpha \subseteq \bigcap_{\xi < \delta} Z_\xi \subseteq Z_\gamma = X^\gamma_0 \]
    Hence \( f(\qty{\gamma,\delta}) = 0 \).
\end{proof}
% TODO: Move this rk
The large cardinal axioms discussed so far fall into a linear hierarchy of consistency strength.
This is known as the \emph{linearity phenomenon}.

\subsection{Strongly compact cardinals}
The compactness theorem for first-order logic says that for any first-order language \( L_S \) and set of axioms \( \Phi \subseteq L_S \),
\[ \Phi \text{ is satisfiable} \leftrightarrow \qty(\forall \Phi_0 \subseteq \Phi.\, \abs{\Phi_0} < \aleph_0 \to \Phi_0 \text{ is satisfiable}) \]
This result cannot work for languages with infinitary conjunctions and disjunctions.
Indeed, if we write
\[ \varphi_F \equiv \bigvee_{i \in \mathbb N} \varphi_{=n};\quad \varphi_{=n} \equiv \text{there are precisely } n \text{ elements};\quad \varphi_{\geq n} \equiv \text{there are at least } n \text{ elements} \]
then
\[ \qty{\varphi_{\geq n} \mid n \in \mathbb N} \cup \qty{\varphi_F} \]
is finitely satisfiable but not satisfiable.
\begin{definition}
    An \emph{\( \mathcal L_{\kappa\kappa} \)-language} is defined by
    \begin{itemize}
        \item a set of variables;
        \item a set \( S \) of function, relation, and constant symbols of finite arity;
        \item the logical symbols \( \wedge, \vee, \neg, \exists, \forall \); and
        \item the infinitary logical symbols \( \bigwedge_{\alpha < \lambda}, \bigvee_{\alpha < \lambda}, \exists^\lambda, \forall^\lambda \) for \( \lambda < \kappa \).
    \end{itemize}
\end{definition}
We define the new syntactic rules as follows.
If \( \varphi_\alpha \) are \( L_S \)-formulas for \( \alpha < \lambda \), then so are \( \bigwedge_{\alpha < \lambda} \varphi_\alpha \) and \( \bigvee_{\alpha < \lambda} \varphi_\alpha \).
If \( \vb v \) is a sequence of variables of length \( \lambda \) and \( \varphi \) is an \( L_S \)-formula, then \( \exists^\lambda \vb v.\, \varphi \) and \( \forall^\lambda \vb v.\, \varphi \) are \( L_S \)-formulas.

We say that \( M \) is a model of \( \bigvee_{\alpha < \lambda} \varphi_\alpha \) if \( M \vDash \varphi_\alpha \) for all \( \alpha < \lambda \).
Similarly, \( M \) models \( \exists^\lambda \vb v.\, \varphi \) if there is a function \( a : \lambda \to M \) such that
\[ M\qty[\frac{a(0)a(1) \dots a(\xi)\dots}{v_0 v_1 \dots v_\xi \dots}] \vDash \varphi \]
\begin{definition}
    An \( \mathcal L_{\kappa\kappa} \)-language \( L_S \) \emph{satisfies compactness} if for all \( \Phi \subseteq L_S \),
    \[ \Phi \text{ is satisfiable} \leftrightarrow \qty(\forall \Phi_0 \subseteq \Phi.\, \abs{\Phi_0} < \kappa \to \Phi_0 \text{ is satisfiable}) \]
\end{definition}
Note that if \( \kappa = \omega \), we recover the standard notion of a first-order language, so all \( \mathcal L_{\omega\omega} \)-languages satisfy compactness.
\begin{definition}
    An uncountable cardinal \( \kappa \) is called \emph{strongly compact}, denoted \( \mathsf{SC}(\kappa) \), if every \( \mathcal L_{\kappa\kappa} \)-language satisfies compactness.
\end{definition}
\begin{theorem}[Keisler--Tarski theorem]
    Suppose \( \kappa \) is a strongly compact cardinal.
    Then every \( \kappa \)-complete filter on \( \kappa \) can be extended to a \( \kappa \)-complete ultrafilter.
\end{theorem}
\begin{proof}
    We define a language \( L \) by creating a constant symbol \( c_A \) for each \( A \subseteq \kappa \), giving \( 2^\kappa \)-many symbols.
    Now let \( L^\star \) be \( L \) with an extra constant symbol \( c \).
    Let
    \[ M = (\mathcal P(\kappa), \in, \qty{A \mid A \subseteq \kappa}) \]
    so \( c_A \) is interpreted by \( A \).
    Let \( \Phi = \operatorname{Th}_L(M) \) be the \( L \)-theory of \( M \).
    In particular,
    \[ M \vDash \forall x.\, x \in c_A \to x \text{ is an ordinal} \]
    and
    \[ M \vDash \forall x.\, x \text{ is an ordinal} \to x \in c_A \vee x \in c_{\kappa \setminus A} \]
    Now let
    \[ \Phi^\star = \Phi \cup \qty{c \in c_A \mid A \in F} \]
    This is a subset of \( L^\star \).
    We show that \( \Phi^\star \) is \( \kappa \)-satisfiable.
    If \( (A_\alpha)_{\alpha < \lambda} \) are subsets of \( \kappa \) such that \( c \in c_{A_\alpha} \) occurs in a \( \kappa \)-small subset of \( \Phi^\star \), then any element \( \eta \in \bigcap_{\alpha < \lambda} A_\alpha \) can be chosen as the interpretation of \( c \).
    As \( F \) is \( \kappa \)-complete, this intersection lies in \( F \) and so is nonempty as required.

    Hence, by strong compactness of \( \kappa \), the theory \( \Phi^\star \) is satisfiable.
    Let \( M \) be a model of \( \Phi^\star \).
    Define
    \[ U = \qty{A \mid A \vDash c \in c_A} \]
    We claim that this is a \( \kappa \)-complete ultrafilter extending \( F \).
    The fact that \( U \) extends \( F \) holds by construction of \( \Phi^\star \).
    It is an ultrafilter because \( M \) believes that \( c \in c_A \) or \( c \in c_{\kappa \setminus A} \).
    It is \( \kappa \)-complete because if \( \qty{A_\alpha \mid \alpha < \lambda} \subseteq U \), let \( A = \bigcap_{\alpha < \lambda} A_\alpha \), then
    \[ M \vDash \forall x.\, \qty(x \in c_A \leftrightarrow \bigwedge_{\alpha < \lambda} x \in c_{A_\alpha}) \]
    As this holds in particular for \( c \), we obtain \( A \in U \).
\end{proof}
\begin{corollary}
    Every strongly compact cardinal is measurable.
\end{corollary}
\begin{proof}
    Let
    \[ F = \qty{A \subseteq \kappa \mid \abs{\kappa\setminus A} < \kappa} \]
    In the case \( \kappa = \omega \), this is known as the Fr\'echet filter.
    This is a \( \kappa \)-complete filter on \( \kappa \).
    If \( U \) extends \( F \) then \( U \) must be nonprincipal, so by the Keisler--Tarski theorem, \( F \) can be extended to a \( \kappa \)-complete nonprincipal ultrafilter on \( \kappa \) as required.
\end{proof}

\subsection{Reflection}
\begin{definition}
    A cardinal \( \kappa \) has the \emph{Keisler extension property}, written \( \mathsf{KEP}(\kappa) \), if there is \( \kappa \in X \supsetneq \mathrm{V}_\kappa \) transitive such that \( \mathrm{V}_\kappa \preceq X \).
\end{definition}
\begin{proposition}
    If \( \kappa \) is inaccessible and satisfies the Keisler extension property, there is an inaccessible cardinal \( \lambda < \kappa \).
\end{proposition}
\begin{proof}
    Fix \( X \) as in the Keisler extension property.
    As \( \kappa \) is inaccessible, \( X \vDash \mathsf{I}(\kappa) \) because \( \kappa \in X \) and inaccessibility is downwards absolute for transitive models.
    Also, \( \mathrm{V}_\kappa \vDash \mathsf{ZFC} \), so \( X \vDash \mathsf{ZFC} \) as it is an elementary superstructure.
    Therefore, \( X \vDash \mathsf{ZFC} + \mathsf{IC} \), so \( \mathrm{V}_\kappa \vDash \mathsf{ZFC} + \mathsf{IC} \).
    So as inaccessibility is absolute between \( \mathrm{V}_\kappa \) and \( \mathrm{V} \), there is an inaccessible \( \lambda < \kappa \).
\end{proof}
The phenomenon that properties of \( X \) occur below \( \kappa \) is called \emph{reflection}.
This argument can be improved in the following sense.
For a given \( \alpha < \kappa \),
\[ X \vDash \exists \lambda > \alpha.\, \mathsf{I}(\lambda) \]
But as \( \alpha \in \mathrm{V}_\kappa \), elementarity gives
\[ \mathrm{V}_\kappa \vDash \exists \lambda > \alpha.\, \mathsf{I}(\lambda) \]
So the set
\[ \qty{\lambda < \kappa \mid \mathsf{I}(\lambda)} \]
is not only nonempty, but cofinal in \( \kappa \).
\begin{corollary}
    Let \( \mathsf{A} \) be the axiom
    \[ \exists \kappa.\, \mathsf{I}(\kappa) \wedge \mathsf{KEP}(\kappa) \]
    Then
    \[ \mathsf{ZFC} + \mathsf{IC} <_{\Con} \mathsf{ZFC} + \mathsf{A} \]
\end{corollary}
\begin{proof}
    It suffices to show that \( \mathsf{ZFC} + \mathsf{A} \vDash \Con(\mathsf{ZFC} + \mathsf{IC}) \).
    We have seen that \( \mathsf{ZFC} + \mathsf{A} \) proves the existence of (at least) two inaccesible cardinals below \( \kappa \), and in particular the larger of the two is a model of \( \mathsf{ZFC} + \mathsf{IC} \).
\end{proof}
\begin{remark}
    This is the main technique for proving strict inequalities of consistency strength.
    Given two large cardinal properties \( \Phi, \Psi \) with the appropriate amount of absoluteness properties, we show that \( \mathsf{ZFC} + \Phi(\kappa) \) proves that the set
    \[ \qty{\lambda < \kappa \mid \Psi(\lambda)} \]
    is cofinal in \( \kappa \).
    Then \( \mathsf{ZFC} + \Phi\mathsf{C} \vDash \Con(\mathsf{ZFC} + \Psi\mathsf{C}) \).
\end{remark}
\begin{example}
    Consider the proof that every inaccessible cardinal has a worldly cardinal below it.
    In the construction, we produce a sequence of ordinals \( (\alpha_i)_{i \in \omega} \), and the worldly cardinal is \( \sup \alpha_i \).
    But we can set \( \alpha_0 = \lambda + 1 \) for a given worldly cardinal \( \lambda < \kappa \), so this gives a cofinal sequence of worldly cardinals below every given inaccessible.
\end{example}
\begin{theorem}
    Every strongly compact cardinal has the Keisler extension property.
\end{theorem}
\begin{proof}
    We want to use the method of (elementary) diagrams to produce a model with \( \mathrm{V}_\kappa \) as a substructure.
    However, we have no way to control whether such a model is well-founded using standard first-order model-theoretic techniques.
    To bypass this issue, we will use infinitary operators.

    Let \( c_x \) be a constant symbol for each \( x \in \mathrm{V}_\kappa \), and let \( L \) be the language with \( \in \) and the \( c_x \).
    Let
    \[ \mathcal V = (\mathrm{V}_\kappa, \in, \qty{x \mid x \in \mathrm{V}_\kappa}) \]
    In first-order logic, \( \mathrm{Th}(X) \) is the elementary diagram of \( \mathrm{V}_\kappa \), so if \( M \vDash \mathrm{Th}(X) \), then \( \mathrm{V}_\kappa \subseteq M \).
    Let \( L_{\kappa} \) be the \( \mathcal L_{\kappa\kappa} \)-language with the same symbols.
    Consider
    \[ \psi \equiv \forall^\omega \vb v.\, \bigvee_{i \in \omega} v_{i+1} \notin v_i \]
    This expresses well-foundedness (assuming \( \mathsf{AC} \)).
    Writing \( \Phi = \mathrm{Th}_{L_\kappa}(\mathcal V) \) for the \( L_\kappa \)-theory of \( \mathcal V \), we must have \( \psi \in \Phi \) since \( \mathrm{V}_\kappa \) is well-founded.
    Thus, if \( M \vDash \Phi \), then \( M \) is a well-founded model containing \( \mathrm{V}_\kappa \).
    By taking the Mostowski collapse, we may also assume that any such \( M \) is transitive.

    Extend \( L_\kappa \) to \( L_\kappa^+ \) with one extra constant \( c \), and let
    \[ \Phi^+ = \Phi \cup \qty{c \text{ is an ordinal}} \cup \qty{c \neq c_x \mid x \in \mathrm{V}_\kappa} \]
    Any model of \( \Phi^+ \) induces a transitive elementary superstructure of \( \mathrm{V}_\kappa \) that contains an ordinal at least \( \kappa \), so by transitivity, \( \kappa \) is in this model.

    We show that \( \Phi^+ \) is satisfiable by showing that it is \( \kappa \)-satisfiable, using the fact that \( \kappa \) is strongly compact.
    Let \( \Phi^0 \subseteq \Phi^+ \) be a subset of size less than \( \kappa \).
    Then we can interpret \( c \) as some ordinal \( \alpha \) greater than all ordinals \( \beta \) occurring in the sentences \( c \neq c_\beta \) in \( \Phi^+ \).
    Then \( \mathcal V \), together with this interpretation of \( c \), is a model of \( \Phi_0 \).
\end{proof}
\begin{corollary}
    \[ \mathsf{ZFC} + \mathsf{IC} <_{\Con} \mathsf{ZFC} + \mathsf{SCC} \]
\end{corollary}
The proof above only used languages with at most \( \kappa \)-many symbols.
Let \( \mathsf{WC}(\kappa) \) be the axiom that every \( \mathcal L_{\kappa\kappa} \)-language with at most \( \kappa \)-many symbols satisfies \( \kappa \)-compactness.
Then we have shown that \( \mathsf{WC}(\kappa) \) implies the Keisler extension property.
One can show that
\[ \mathsf{W}(\kappa) \leftrightarrow \mathsf{WC}(\kappa) \]
So the cardinals \( \kappa \) that satisfy \( \mathsf{WC}(\kappa) \) are precisely the weakly compact cardinals.
In particular,
\[ \mathsf{ZFC} + \mathsf{IC} <_{\Con} \mathsf{ZFC} + \mathsf{WCC} \]
Note that in the proof that strongly compact cardinals are measurable, we used a language with \( 2^\kappa \)-many symbols.

\subsection{Ultrapowers of the universe}
In order to avoid proper classes, we will consider ultrapowers of particular set universes.
Later, we will briefly explain how all of this could have been done in a proper class universe such as \( \mathrm{V} \).
For convenience, we will assume that \( \kappa < \lambda \) where \( \kappa \) is measurable and \( \lambda \) is inaccessible, so \( \mathrm{V}_\lambda \vDash \mathsf{ZFC} + \mathsf{MC} \).
We will take the ultrapower of \( \mathrm{V}_\lambda \).

Let \( U \) be a \( \kappa \)-complete nonprincipal ultrafilter on \( \kappa \), and form the ultrapower of \( \mathrm{V}_\lambda \), consisting of equivalence classes of functions \( f : \kappa \to \mathrm{V}_\lambda \) where \( f \sim g \) when \( \qty{\alpha \mid f(\alpha) = g(\alpha)} \in U \).
\[ \faktor{{\mathrm{V}_\lambda}^\kappa}{U} = \qty{[f] \mid f : \kappa \to \mathrm{V}_\lambda} \]
The membership relation on the ultrapower is given by
\[ [f] \mathrel{E} [g] \leftrightarrow \qty{\alpha \mid f(\alpha) \in g(\alpha)} \in U \]
We have an embedding \( \ell \) from \( \mathrm{V}_\lambda \) into the ultrapower by mapping \( x \in \mathrm{V}_\lambda \) to the equivalence class of its constant function \( c_x : \kappa \to \mathrm{V}_\lambda \).
This is an elementary embedding by \L{}o\'s' theorem.
Hence
\[ \qty(\mathrm{V}_\lambda, \in) \equiv \qty(\faktor{{\mathrm{V}_\lambda}^\kappa}{U}) \]
so they both model \( \mathsf{ZFC} + \mathsf{MC} \), and in particular, \( [c_{\kappa}] \) is a measurable cardinal.
\begin{remark}
    \begin{enumerate}
        \item Suppose \( \faktor{{\mathrm{V}_\lambda}^\kappa}{U} \vDash [f] \text{ is an ordinal} \).
        By \L{}o\'s' theorem,
        \[ X = \qty{\alpha \mid f(\alpha) \text{ is an ordinal}} \in U \]
        We can define
        \[ f'(\alpha) = \begin{cases}
            f(\alpha) & \text{if } \alpha \in X \\
            0 & \text{otherwise}
        \end{cases} \]
        Note that \( f \sim f' \), so \( [f] = [f'] \).
        So without loss of generality, we can assume \( f \) is a function into \( \mathrm{Ord} \cap \lambda = \lambda \), so \( f : \kappa \to \lambda \).
        Since \( \lambda \) is inaccessible, \( f \) cannot be cofinal, so there is \( \gamma < \lambda \) such that \( f : \kappa \to \gamma \).
        Note also that, for example, we can define \( f + 1 \) by
        \[ (f + 1)(\alpha) = f(\alpha) + 1 \]
        so
        \[ \qty{\alpha \mid (f+1)(\alpha) \text{ is the successor of } f(\alpha)} = \kappa \in U \]
        hence by \L{}o\'s' theorem, \( [f + 1] \) is the successor of \( [f] \).
        \item If \( f : \kappa \to \mathrm{V}_\lambda \) is arbitrary, the set
        \[ \qty{\rank f(\alpha) \mid \alpha \in \kappa} \]
        cannot be cofinal in \( \lambda \), so there is \( \gamma < \lambda \) such that \( f \in \mathrm{V}_\gamma \).
        However, the equivalence class \( [f] \) is unbounded in \( \mathrm{V}_\lambda \).
        \item Given \( f \), by (ii) we may assume \( f \in \mathrm{V}_\gamma \) for some \( \gamma < \lambda \).
        If \( [g] \mathrel{E} [f] \), then
        \[ X = \qty{\alpha \mid g(\alpha) \in f(\alpha)} \in U \]
        Now we can define
        \[ g'(\alpha) = \begin{cases}
            g(\alpha) & \text{if } \alpha \in X \\
            0 & \text{otherwise}
        \end{cases} \]
        Then \( g \sim g' \) so \( [g] = [g'] \), and \( g' \in \mathrm{V}_\gamma \).
        Therefore,
        \[ \abs{\qty{[g] \mid [g] \mathrel{E} [f]}} \leq \abs{\mathrm{V}_\gamma} < \lambda \]
    \end{enumerate}
\end{remark}
\begin{lemma}
    \( \faktor{{\mathrm{V}_\lambda}^\kappa}{U} \) is \( E \)-well-founded.
\end{lemma}
\begin{proof}
    Suppose not, so let \( \qty{[f_n] \mid n \in \mathbb N} \) be a strictly decreasing sequence, so
    \[ [f_{n+1}] \mathrel{E} [f_n] \]
    By definition,
    \[ X_n = \qty{\alpha \mid f_{n+1}(\alpha) \in f_n(\alpha)} \in U \]
    But as \( U \) is \( \kappa \)-complete,
    \[ \bigcap_{n \in \mathbb N} X_n \in U \]
    In particular, there must be an element \( \alpha \in \bigcap_{n \in \mathbb N} X_n \).
    Hence, \( f_n(\alpha) \) is an \( \in \)-decreasing sequence in \( \mathrm{V}_\lambda \), which is a contradiction.
\end{proof}
Note that we only used \( \aleph_1 \)-completeness of \( U \).

We can take the Mostowski collapse to produce a transitive set \( M \) such that
\[ \pi : \qty(\faktor{{\mathrm{V}_\lambda}^\kappa}{U}, E) \cong (M, \in) \]
Combining \( \ell \) and \( \pi \), we obtain
\[ j = \pi \circ \ell : (\mathrm{V}_\lambda, \in) \to (M, \in) \]
given by
\[ j(x) = \pi(\ell(x)) = \pi([c_x]) \]
For convenience, will write \( (f) \) to abbreviate \( \pi([f]) \), so \( j(x) = (c_x) \).
\begin{lemma}
    \( M \subseteq \mathrm{V}_\lambda \).
\end{lemma}
\begin{proof}
    Note that because \( \lambda \) is inaccessible, \( \mathrm{V}_\lambda = \mathrm{H}_\lambda \), where
    \[ \mathrm{H}_\lambda = \qty{x \mid \abs{\operatorname{tcl}(x)} < \lambda} \]
    Since \( M \) is transitive, if \( \abs{x} < \lambda \) for each \( x \in M \), then \( M \subseteq \mathrm{H}_\lambda \).
    But remark (iii) above shows precisely what is required.
\end{proof}
\begin{lemma}
    \( \mathrm{Ord} \cap M = \lambda \).
\end{lemma}
\begin{proof}
    Under the elementary embedding \( j \), ordinals in \( \mathrm{V}_\lambda \) are mapped to ordinals in \( M \).
    So \( j \) restricts to an order-preserving embedding from \( \lambda \) into a subset of \( \lambda \).
    Thus this embedding is unbounded, and therefore by transitivity, \( \mathrm{Ord} \cap M = \lambda \).
\end{proof}
\begin{lemma}
    \( \eval{j}_{\mathrm{V}_\kappa} = \id \), so in particular, \( \mathrm{V}_\kappa \subseteq M \).
\end{lemma}
\begin{proof}
    We show this by \( \in \)-induction on \( \mathrm{V}_\kappa \).
    Suppose that \( x \in \mathrm{V}_\kappa \) is such that for all \( y \in x \), \( j(y) = y \).
    For any \( y \in x \), by elementarity, \( j(y) \in j(x) \), but \( j(y) = y \) so \( y \in j(x) \) as required.
    For the converse, suppose \( y \in j(x) \).
    Then define \( f \) such that \( y = (f) \), so \( (f) \in (c_x) \).
    Hence
    \[ X = \qty{\alpha \mid f(\alpha) \in c_x(\alpha)} = \qty{\alpha \mid f(\alpha) \in x} \in U \]
    But
    \[ \qty{\alpha \mid f(\alpha) \in x} = \bigcup_{z \in x} \qty{\alpha \mid f(\alpha) = z} \]
    This is a union of \( \abs{x} \)-many sets.
    By \( \kappa \)-completeness, there must be some \( z \in x \) such that
    \[ \qty{\alpha \mid f(\alpha) = z} \in U \]
    Hence \( f \sim c_z \).
    Therefore, \( (f) = j(z) \), and by the inductive hypothesis, \( j(z) = z \).
    Hence \( y \in x \).
\end{proof}
\begin{lemma}
    \( j \neq \id \), as \( j(\kappa) > \kappa \).
\end{lemma}
\begin{proof}
    We know that \( j(\kappa) = (c_\kappa) \).
    By the previous lemma, for each \( \alpha < \kappa \), \( j(\alpha) = (c_\alpha) = \alpha \).
    Consider the identity map \( \id_\kappa : \kappa \to \kappa \).
    We have
    \begin{align*}
        (c_\alpha) < (\id_\kappa) &\leftrightarrow \qty{\gamma \mid c_\alpha(\gamma) < \id_\kappa(\gamma)} \in U \\
        &\leftrightarrow \qty{\gamma \mid \alpha < \gamma} \in U
    \end{align*}
    But by a size argument, \( \qty{\gamma \mid \gamma \leq \alpha} \notin U \) as \( U \) is nonprincipal, so we must have \( \alpha < (\id) \).
    Also,
    \begin{align*}
        (\id_\kappa) < (c_\kappa) &\leftrightarrow \qty{\gamma \mid \id_\kappa(\gamma) < c_\kappa(\gamma)} \in U \\
        &\leftrightarrow \qty{\gamma \mid \gamma < \kappa} \in U
    \end{align*}
    This is certainly in \( U \).
    So for all \( \alpha < \kappa \),
    \[ \alpha < (\id_\kappa) < j(\kappa) \]
    giving
    \[ \kappa \leq (\id_\kappa) < j(\kappa) \]
    as required
\end{proof}
\begin{remark}
    \begin{enumerate}
        \item This implies that \( \eval{j}_{\mathrm{V}_{\kappa + 1}} \neq \id \), so the identity result above cannot be strengthened.
        \item This also shows that many of the elements of \( M \) arise from non-constant functions.
        \item The set
        \[ \qty{j(x) \mid x \in \mathrm{V}_\lambda} \]
        is isomorphic to \( \mathrm{V}_\lambda \).
        Therefore, there is a (non-transitive) copy of \( \mathrm{V}_\lambda \) that sits strictly inside \( M \).
        \item Let \( f : \kappa \to \kappa \) be a function such that for all \( \gamma < \kappa \), \( \id_\kappa(\gamma) < f(\gamma) \).
        Then \( (\id_\kappa) < (f) \).
        For example, the functions \( f_2(\gamma) = \gamma \cdot 2 \) and \( f_3(\gamma) = \gamma \cdot 3 \) satisfy \( (\id_\kappa) < (f_2) < (f_3) \).
        \item At the moment, we do not know whether \( (\id_\kappa) = \kappa \).
        Consider
        \[ f(\gamma) = \begin{cases}
            \gamma - 1 & \text{if } \gamma \text{ is a successor} \\
            \gamma & \text{if } \gamma \text{ is a limit}
        \end{cases} \]
        Then
        \[ (f) < (\id_\kappa) \leftrightarrow \qty{\alpha \mid \alpha \text{ is a limit}} \notin U \]
        We will discuss this in more detail later.
    \end{enumerate}
\end{remark}
\begin{definition}
    Let \( j : \mathrm{V}_\lambda \to M \) be an elementary embedding such that \( M \subseteq \mathrm{V}_\lambda \) is transitive.
    An ordinal \( \mu \) is called the \emph{critical point} of \( j \), written \( \operatorname{crit}(j) \), if \( j \neq \id \) and \( \mu \) is the least ordinal \( \alpha \). such that \( j(\alpha) > \alpha \).
\end{definition}
Note that if \( j \neq \id \), it moves the rank of some set, so moves some ordinal.
Therefore, if \( j \neq \id \), it has a critical point.

In this terminology, the critical point of the embedding \( j \) above is \( \kappa \).
\begin{remark}
    \begin{enumerate}
        \item \( M \) is closed under finite intersections: if \( A, B \in M \), then \( A \cap B \in M \).
        \item \( \mathrm{V}_\kappa \in M \).
        To show this, we claim that the set
        \[ W = \qty{y \in M \mid M \vDash \rank y < \kappa} \]
        is equal to \( \mathrm{V}_\kappa \).
        Then, since \( M \) models \( \mathsf{ZFC} \), the set \( W \) is \( \mathrm{V}_\kappa^M \), so \( W \in M \).

        If \( x \in \mathrm{V}_\kappa \), then \( \rank x = \alpha < \kappa \), so \( j(x) = x \).
        By elementarity, \( \rank x = \rank j(x) = j(\alpha) = \alpha \) as required.
        Conversely, suppose that \( M \vDash \rank y = \gamma \) for \( \gamma < \kappa \).
        There is \( f \) such that \( y = (f) \), and without loss of generality we can take \( f : \kappa \to \mathrm{V}_{\gamma + 1} \).
        But \( \abs{\mathrm{V}_{\gamma + 1}} < \kappa \), and so by the argument in the lemma proving \( \eval{j}_{\mathrm{V}_\kappa} = \id \), there is some \( x \in \mathrm{V}_{\gamma + 1} \) such that \( \qty{\alpha \mid f(\alpha) = x} \in U \).
        Hence \( f \sim c_x \), and so \( y = j(x) = x \).
    \end{enumerate}
\end{remark}
\begin{lemma}
    \( \mathrm{V}_{\kappa + 1} \subseteq M \).
\end{lemma}
Note that \( \eval{j}_{\mathrm{V}_{\kappa + 1}} \neq \id \).
\begin{proof}
    Let \( A \in \mathrm{V}_{\kappa + 1} \), so \( A \subseteq \mathrm{V}_\kappa \).
    We claim that \( A = j(A) \cap \mathrm{V}_\kappa \).
    Then, by the two remarks above, this implies \( A \in M \).

    Suppose \( x \in A \subseteq \mathrm{V}_\kappa \).
    By elementarity, \( j(x) \in j(A) \), but \( x = j(x) \), so \( x \in j(A) \).
    Conversely, suppose \( x \in j(A) \cap \mathrm{V}_\kappa \).
    Then \( x = j(x) \), so \( j(x) \in j(A) \).
    So by elementarity in the other direction, \( x \in A \).
\end{proof}
\begin{lemma}
    \( \mathrm{V}_\lambda \vDash \abs{j(\kappa)} \leq 2^\kappa \).
\end{lemma}
\begin{proof}
    Recall that if \( f \in \mathrm{V}_\gamma \) then \( \abs{(f)} \leq \abs{\mathrm{V}_\gamma} \).
    So if \( (f) \in j(\kappa) = (c_\kappa) \), we can assume \( f : \kappa \to \kappa \), and there are only \( 2^\kappa \)-many such functions.
\end{proof}
In particular, \( \mathrm{V}_\lambda \) believes that \( j(\kappa) \) is not a strong limit cardinal.
Hence,
\begin{lemma}
    \( M \neq \mathrm{V}_\lambda \).
\end{lemma}
\begin{proof}
    \( M \) believes that \( j(\kappa) \) is measurable, so in particular it believes \( j(\kappa) \) is a strong limit.
    Hence \( M \neq \mathrm{V}_\lambda \).
\end{proof}
There is a strengthening of this result which exhibits a witness to \( M \subsetneq \mathrm{V}_\lambda \), discussed on the example sheets.
Namely, we can show that \( U \notin M \).
In order to show this, we prove that for arbitrary transitive \( N \subseteq \mathrm{V}_\lambda \) with \( U \in N \), we have \( N \vDash \abs{j(\kappa)} \leq 2^\kappa \).
In particular, \( \mathrm{V}_{\kappa + 2} \nsubseteq M \).
% TODO: the drawing(s) from the lecture on 23rd of February

Note that \( M \) might still believe that \( \kappa \) is measurable, even though \( U \notin M \).
There could be some other \( U' \in V_{\kappa + 2} \) which is \( \kappa \)-complete and nonprincipal.

Recall that the Keisler extension property for a transitive model \( X \) is the statement that there is \( \kappa \in X \) such that \( \mathrm{V}_\kappa \preceq X \).
Properties of \( X \) reflect down into \( \mathrm{V}_\kappa \): if \( \alpha \in \mathrm{Ord}^X \) and \( \Phi \) is a property such that \( X \vDash \Phi(\kappa) \), then
\[ M \vDash \exists \mu.\, \alpha < \mu \wedge \Phi(\mu) \]
so
\[ \mathrm{V}_\kappa \vDash \exists \mu.\, \alpha < \mu \wedge \Phi(\mu) \]
hence
\[ C_\Phi = \qty{\gamma < \kappa \mid \Phi(\gamma)} \subseteq \kappa \]
is cofinal in \( \kappa \).
If \( \Phi \) is any property such that \( M \vDash \Phi(\kappa) \), then for any \( \alpha < \kappa \),
\[ M \vDash \exists \mu.\, j(\alpha) < \mu < j(\kappa) \wedge \Phi(\mu) \]
By elementarity,
\[ \mathrm{V}_\lambda \vDash \exists \mu.\, \alpha < \mu < \kappa \wedge \Phi(\mu) \]
Note that \( \alpha = j(\alpha) \).
So
\[ C_\Phi = \qty{\gamma < \kappa \mid \Phi(\gamma)} \]
is cofinal in \( \kappa \).
\begin{example}
    \begin{enumerate}
        \item Let \( \Phi(\kappa) = \mathsf{I}(\kappa) \) be the statement that \( \kappa \) is inaccessible.
        By absoluteness, \( M \vDash \mathsf{I}(\kappa) \), so
        \[ C_{\mathsf{I}} = \qty{\gamma < \kappa \mid \mathsf{I}(\gamma)} \]
        is cofinal.
        So if \( \kappa \) is measurable, it is the \( \kappa \)th inaccessible cardinal.
        \item Let \( \Phi(\kappa) = \mathsf{W}(\kappa) \) be the statement that \( \kappa \) is weakly compact.
        We show that \( M \vDash \mathsf{W}(\kappa) \).
        Let \( c : [\kappa]^2 \to 2 \) be a colouring in \( M \); we find \( H \in [\kappa]^\kappa \) in \( M \) that is monochromatic for \( c \).
        By the fact that \( \mathrm{V}_\lambda \vDash \mathsf{W}(\kappa) \), we obtain \( H \) as above in \( \mathrm{V}_\lambda \).
        But this \( H \) is a subset of \( \kappa \), so is an element of \( \mathrm{V}_{\kappa + 1} \subseteq M \) as required.
        By the reflection argument,
        \[ C_{\mathsf{W}} = \qty{\gamma < \kappa \mid \mathsf{W}(\gamma)} \]
        is cofinal in \( \kappa \).
        So the least weakly compact cardinal is not measurable.
    \end{enumerate}
\end{example}
\begin{definition}
    A property \( \Phi \) is called \emph{\( \beta \)-stable} if for all transitive models \( M \) and all \( \kappa \), if \( \Phi(\kappa) \) holds and \( \mathrm{V}_{\kappa + \beta} \subseteq M \) then \( M \vDash \Phi(\kappa) \).
\end{definition}
\begin{remark}
    \begin{enumerate}
        \item Weak compactness is 1-stable, and 1-stable properties of measurable cardinals reflect at a measurable cardinal.
        \item Measurability is 2-stable, because the property \( \Xi \) of being a \( \kappa \)-complete nonprincipal ultrafilter is absolute, but the existence of the ultrafilter requires two power set operations:
        \[ \mathsf{M}(\kappa) \leftrightarrow \exists U \in \mathrm{V}_{\kappa + 2}.\, \Xi(U) \]
    \end{enumerate}
\end{remark}
\begin{example}
    Suppose that \( M \vDash \mathsf{M}(\kappa) \).
    Then by the same reflection argument, the set \( C_{\mathsf{M}} \) is cofinal in \( \kappa \), so \( \kappa \) is the \( \kappa \)th measurable cardinal, and so is not the least.
\end{example}
\begin{definition}
    A cardinal \( \kappa \) is called \emph{surviving}, written \( \mathsf{Surv}(\kappa) \), if there is \( \lambda > \kappa \) inaccessible, a \( \kappa \)-complete nonprincipal ultrafilter on \( \kappa \), a transitive model \( M \) such that \( M \cong \faktor{{\mathrm{V}_\lambda}^\kappa}{U} \) and \( j \) is the elementary embedding derived from \( U \), where \( M \vDash \mathsf{M}(\kappa) \).
\end{definition}
By the example above, if \( \kappa \) is the first surviving cardinal, it is the \( \kappa \)th measurable.
Under sufficient consistency assumptions, we have the following.
\begin{corollary}
    \( \mathsf{MC} <_{\Con} \mathsf{SurvC} \).
\end{corollary}
\begin{proof}
    Let \( \kappa \) be a surviving cardinal.
    By the previous results, we can find \( \lambda_0 < \lambda_1 < \kappa \) such that \( \lambda_0, \lambda_1 \) are both measurable.
    Then \( \lambda_1 \) is inaccessible, so \( \mathrm{V}_{\lambda_1} \vDash \mathsf{ZFC} + \mathsf{M}(\lambda_0) \) by 2-stability of measurability and the fact that \( \mathrm{V}_{\lambda_0 + 2} \subseteq \mathrm{V}_{\lambda_1} \).
\end{proof}

\subsection{The fundamental theorem on measurable cardinals}
\begin{theorem}
    Suppose \( \lambda \) is inaccessible and \( \kappa < \lambda \).
    Then the following are equivalent.
    \begin{enumerate}
        \item \( \kappa \) is measurable.
        \item There is a transitive model \( M \) of \( \mathsf{ZFC} \) with \( \mathrm{V}_{\kappa + 1} \subseteq M \) and an elementary embedding \( j : \mathrm{V}_\lambda \to M \) such that \( j \neq \id \) and \( \kappa = \operatorname{crit}(j) \).
    \end{enumerate}
\end{theorem}
\begin{proof}
    We have already shown that (i) implies (ii).
    For the converse, we define an ultrafilter \( U \) by
    \[ U = \qty{A \subseteq \kappa \mid \kappa \in j(A)} \]
    Note that if \( A \subseteq \kappa \), then \( j(A) \subseteq j(\kappa) \), so it could in fact be the case that \( \kappa \in j(A) \).
    We show that \( U \) is a \( \kappa \)-complete nonprincipal ultrafilter.
    \begin{itemize}
        \item We have \( \kappa \in U \) precisely if \( \kappa \in j(\kappa) \), but this is true as \( \kappa \) is the critical point of \( j \).
        \item \( \varnothing \in U \) precisely if \( \kappa \in j(\varnothing) \), but \( j(\varnothing) = \varnothing \) as \( j \) is an elementary embedding.
        \item If \( A \in U \) and \( B \supseteq A \), then \( \kappa \in j(A) \), but \( j(B) \supseteq j(A) \) by elementarity, so \( \kappa \in j(B) \) giving \( B \in U \).
        \item Suppose \( A \notin U \).
        Then \( \kappa \notin j(A) \).
        We want to show \( \kappa \setminus A \in U \), or equivalently, \( \kappa \in j(\kappa \setminus A) \).
        By elementarity, \( j(\kappa \setminus A) = j(\kappa) \setminus j(A) \).
        But \( \kappa \in j(\kappa) \setminus j(A) \) as required.
        \item We show \( U \) is nonprincipal.
        Let \( \alpha \in \kappa \).
        Then \( \qty{\alpha} \in U \) precisely when \( \kappa \in j(\qty{\alpha}) = \qty{j(\alpha)} \).
        But \( \alpha < \kappa \), so \( j(\alpha) = \alpha \neq \kappa \), hence \( U \) cannot be principal.
        \item Finally, we show \( \kappa \)-completeness; this will also show the finite intersection property required for \( U \) to be a filter.
        Let \( \gamma < \kappa \), and fix \( (A_\alpha)_{\alpha < \gamma} \) such that \( A_\alpha \in U \) for each \( \alpha < \gamma \).
        Then \( \kappa \in j(A_\alpha) \) for all \( \alpha < \gamma \).
        Then \( \bigcap_{\alpha < \gamma} A_\alpha \in U \) if and only if \( \kappa \in j\qty(\bigcap_{\alpha < \gamma} A_\alpha) \).
        Note that being an element of \( \bigcap_{\alpha < \gamma} A_\gamma \) is a formula that says that \( \vb A \) is a sequence of objects \( A_\alpha \), the \( \alpha \)th element of this sequqence is \( A_\alpha \), and \( \beta \) is an element of each element of the sequence.
        Therefore \( \beta \in j\qty(\bigcap_{\alpha < \gamma} A_\alpha) \) if and only if \( \beta \) is an element of all elements of the sequence \( j(\vb A) \).
        Clearly, \( j(\vb A) \) is a sequence of subsets of \( j(\kappa) \) of length \( j(\gamma) = \gamma \).
        Since \( A_\alpha \) is the \( \alpha \)th element of \( \vb A \), \( j(A_\alpha) \) is the \( j(\alpha) \)th element of \( j(\vb A) \), but \( j(\alpha) = \alpha \).
        Hence \( j(\vb A) \) is the sequence \( (j(A_\alpha))_{\alpha < \gamma} \).
        Then
        \[ j\qty(\bigcap_{\alpha < \gamma} A_{\alpha}) = \bigcap_{\alpha < \gamma} j(A_\alpha) \]
        giving \( \kappa \)-completeness as required.
    \end{itemize}
\end{proof}
\begin{remark}
    Given a sequence \( \vb A \) of subsets of \( \kappa \) of length \( \gamma \), then \( j(\vb A) \) is a sequence of subsets of \( j(\kappa) \) of length \( j(\gamma) \).
    Moreover, if \( A_\alpha \) is the \( \alpha \)th element of \( \vb A \), then \( j(A_\alpha) \) is the \( j(\alpha) \)th element of \( j(\vb A) \).
    In the situation above, \( \gamma < \kappa \), so \( j(\gamma) = \gamma \) and \( j(\alpha) = \alpha \), so \( j(\vb A) = \qty{j(A_\alpha) \mid \alpha < \gamma} \).
    If, for example, \( \gamma = \kappa \), then \( j(\vb A) \) is a sequence of length \( j(\kappa) \), which is strictly longer.
    Despite this, the first \( \kappa \)-many elements of the sequence are still \( j(A_\alpha) \) for \( \alpha < \kappa \).
    Beyond \( \kappa \), we do not know what the elements of \( j(\vb A) \) look like.
    This remark suffices for the following result.
\end{remark}
\begin{proposition}
    For arbitrary embeddings \( j \) with critical point \( \kappa \), the ultrafilter \( U_j \) constructed above is normal.
\end{proposition}
\begin{proof}
    Suppose \( A_\alpha \in U_j \) for each \( \alpha < \kappa \), or equivalently, \( \kappa \in j(A_\alpha) \).
    We must show \( \kappa \in j\qty(\operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha < \kappa}(A_\alpha)) \).
    We have
    \begin{align*}
        \xi \in \operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha < \kappa}(A_\alpha) &\leftrightarrow \xi \in \bigcap_{\alpha < \xi} A_\alpha \\
        &\leftrightarrow \forall \alpha < \xi.\, \xi \in A_\alpha \\
        \xi \in j\qty(\operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha < \kappa}(A_\alpha)) &\leftrightarrow \forall \alpha < \xi.\, \xi \in j(\vb A)_{j(\alpha)}
    \end{align*}
    Substitute \( \kappa \) for \( \xi \) and obtain
    \begin{align*}
        \kappa \in j\qty(\operatorname*{\scalerel*{\mupDelta}{\textstyle\sum}}_{\alpha < \kappa}(A_\alpha)) &\leftrightarrow \forall \alpha < \kappa.\, \kappa \in j(\vb A)_{j(\alpha)} \\
        &\leftrightarrow \forall \alpha < \kappa.\, \kappa \in j(\vb A)_\alpha \\
        &\leftrightarrow \forall \alpha < \kappa.\, \kappa \in j(A_\alpha)
    \end{align*}
    which holds by assumption.
\end{proof}
\begin{remark}
    \begin{enumerate}
        \item This gives an alternative proof of the existence of a normal ultrafilter on a measurable cardinal.
        \item The operations \( U \mapsto j_U \) and \( j \mapsto U_j \) are not inverses in general.
        In particular, if \( U \) is not normal, \( U_{j_U} \neq U \).
    \end{enumerate}
\end{remark}
\begin{proposition}
    Let \( U \) be a \( \kappa \)-complete nonprincipal ultrafilter on \( \kappa \).
    Then the following are equivalent.
    \begin{enumerate}
        \item \( U \) is normal;
        \item \( (\id) = \kappa \).
    \end{enumerate}
\end{proposition}
This proposition provides an alternative view of reflection.
Suppose that the ultrafilter \( U \) on \( \kappa \) is normal.
If \( M \vDash \Phi(\kappa) \), then \( M \vDash \Phi((\id)) \).
By \L{}o\'s' theorem,
\[ \qty{\alpha < \kappa \mid \Phi(\id(\alpha))} \in U \]
So \( \Phi \) reflects not only on a set of size \( \kappa \), but on an ultrafilter set.
In particular, if \( \Phi = \mathsf{M} \) and \( M \vDash \mathsf{M}(\kappa) \), so if \( \kappa \) is surviving, then the set of \( \alpha \) that are measurable is in \( U \).
Using this result, we can characterise the surviving cardinals in a more elegant way.
\begin{theorem}
    \( \kappa \) is surviving if and only if there is a normal ultrafilter on \( \kappa \) such that \( \qty{\alpha < \kappa \mid \mathsf{M}(\alpha)} \in U \).
\end{theorem}
\begin{proof}
    We have just shown one direction.
    For the converse, suppose the set \( C = \qty{\alpha < \kappa \mid \mathsf{M}(\alpha)} \) is in \( U \).
    Then for each \( \alpha \in C \), one can find an \( \alpha \)-complete nonprincipal ultrafilter on \( \alpha \) called \( U_\alpha \).
    Define
    \[ f(\alpha) = \begin{cases}
        U_\alpha & \text{if } \alpha \in C \\
        \varnothing & \text{if } \alpha \notin C
    \end{cases} \]
    Thus the set of \( \alpha \) such that \( f(\alpha) \) is an \( \alpha \)-complete nonprincipal ultrafilter on \( \alpha \) is \( C \), so in \( U \).
    Equivalently, the set of \( \alpha \) such that \( f(\alpha) \) is an \( \id(\alpha) \)-complete nonprincipal ultrafilter on \( \id(\alpha) \) is in \( U \).
    So by \L{}o\'s' theorem, \( M \) believes that \( (f) \) is an \( (\id) \)-complete nonprincipal ultrafilter on \( (\id) \).
    So \( (f) \) witnesses that \( \kappa \) is measurable in \( M \).
\end{proof}
This shows that whether a cardinal \( \kappa \) is surviving depends only on \( \mathrm{V}_{\kappa + 2} \), and is therefore a 2-stable property.
\begin{definition}
    If \( U, U' \) are normal ultrafilters on \( \kappa \), we write \( U <_M U' \) if
    \[ C = \qty{\alpha \mid \mathsf{M}(\alpha)} \in U \]
    and there is a sequence of ultrafilters \( U_\alpha \) on \( \alpha \in C \) such that
    \[ A \in U' \leftrightarrow \qty{\alpha \mid A \cap \alpha \in U_\alpha} \in U \]
    This is known as the \emph{Mitchell order}.
\end{definition}
Then \( \kappa \) is surviving if and only if there are \( U, U' \) on \( \kappa \) such that \( U <_M U' \), because of the fact that if \( h(\alpha) = A \cap \alpha \) then \( (h) = A \).
Note that talking about sequences of Mitchell-ordered ultrafilters is also 2-stable.
